Splunk® Enterprise

Admin Manual

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Set limits on disk usage

There are several methods for controlling disk space used by Splunk. Most disk space will be used by Splunk's indexes, which include the compressed raw data. If you run out of disk space, Splunk will stop indexing. You can set a minimum free space limit to control how low you will let free disk space fall before indexing stops. Indexing will resume once space exceeds the minimum.

Set minimum free disk space

You can set a minimum amount of space to keep free on the disk where indexed data is stored. If the limit is reached, splunkd stops operating. Both indexing and searching are affected:

  • Periodically, splunkd will check space on all partitions that contain splunk indexes. If the free disk space limit has been reached on any of those partitions, splunkd stops indexing data until more space is available. A UI banner and splunkd warning are posted to indicate the need to clear more disk space.
  • Before attempting to launch a search, Splunk will require this amount of free space on the filesystem where the dispatch directory is stored, $SPLUNK_HOME/var/run/splunk/dispatch

The default minimum free disk space is 2000MB.

Note:

  • Splunk will not clear any of its own disk space with this method. It will simply pause for more space to become available.
  • Events can be lost if they are not written to a file during such a pause.

You can set minimium free disk space through Splunk Web, the CLI, or the server.conf configuration file.

In Splunk Web

  • Click Manager in the upper right corner of Splunk Web.
  • Click System settings.
  • Click General settings.
  • Under the Index settings section, find Pause indexing if free disk space (in MB) falls below::

Disk settings.jpg

  • Enter your desired minimum free disk space in megabytes.
  • Click Save.

Restart Splunk for your changes to take effect.

From the command line interface (CLI)

You can set the minimum free disk space via Splunk's CLI. To use the CLI, navigate to the $SPLUNK_HOME/bin/ directory and use the ./splunk command. Here, you set the minimum free disk space to 20,000MB (20GB):

# splunk set minfreemb 20000

# splunk restart

In server.conf

You can also set the minimum free disk space in the server.conf file. The relevant stanza/attribute is this:

[diskUsage]
minFreeSpace = <num>

Note that <num> represents megabytes. The default is 2000.

Control database storage

The indexes.conf file contains index configuration settings. You can control disk storage usage by specifying maximum index size or maximum age of data. When one of these limits is reached, the oldest indexed data will be deleted (the default) or archived. You can archive the data by using a predefined archive script or creating your own.

For detailed instructions on how to use indexes.conf to set maximum index size or age, see "Set a retirement and archiving policy".

For information on creating archive scripts, see "Archive indexed data".

For detailed information on index storage, see "How Splunk stores indexes".

PREVIOUS
Set up multiple indexes
  NEXT
How Splunk stores indexes

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Comments

Ranjyotiprakash - Thanks for pointing out that problem with the procedure. It has now been fixed.

Sgoodman, Splunker
April 6, 2012

To set minimum free disk space <br />In splunk web<br />Click Manager -> Click System settings -> Click General Setting.<br />Inside that<br />Under the Index settings section, find Pause indexing if free disk space (in MB) falls below::<br />Enter your value and SAVE.

Ranjyotiprakash
April 6, 2012

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters